Docker - Setup with Two Tomcat with Nginx / SFTP

imp commands
************
find / -name tomcat8


Oracle jdk 1.8
**************
sudo add-apt-repository ppa:webupd8team/java
sudo apt-get update
sudo apt-get install oracle-java8-installer

#this will give all ip and other details
docker inspect


imp commands
+++++++++++++
docker run -it ubuntu
apt-get update
apt-get install vim
apt-get install net-tools
apt-get install python-software-properties
apt-get install software-properties-common
add-apt-repository ppa:webupd8team/java
apt-get update
apt-get install oracle-java8-installer
apt-get install -y net-tools
apt-get update
apt-get install tomcat7 vim
echo $JAVA_HOME
export JAVA_HOME=/usr/lib/jvm/java-8-oracle
vim /etc/default/tomcat7
# now ensure in tomcat7 file
# remove the comment
JAVA_HOME=/usr/lib/jvm/java-8-oracle
ifconfig
service tomcat7 start

wget localhost:8080

docker commit/push/pull
docker ps -a
docker commit
docker push drvijayy2k2/ubuntutomcat1
docker pull drvijayy2k2/ubuntutomcat1


to show all process - ps aux


Now instead of exiting the container, detach from it back to your terminal by typing:
ctrl-p then ctrl-q
(If you’re using gnu screen, remember it’s ctrl-a a ctrl-p, then ctrl-q)


uninstall
*********
sudo apt-get purge docker-engine
sudo apt-get autoremove --purge docker-engine

umount /var/lib/docker/overlay #check and remvoe all the containers
umount /var/lib/docker/overlay2

rm -rf /var/lib/docker # This deletes all images, containers, and volumes

dettach
ctrl + a + p + q

80, 8080,8081,8082, 8888 - opened for outside

tomcat1
docker run --name tomcat1 -p 8080:8080 -it drvijayy2k2/tomcat8
service tomcat8 start
wget localhost:8080
ctrl + a + p + q
browser - http://ip-1:8080/

you can change the root file
apt-get install vim
find / -name tomcat8
vi /var/lib/tomcat8/webapps/ROOT/index.html
vi /usr/share/tomcat8/startup.sh

tomcat2
docker run --name tomcat2 -p 8081:8080 -it drvijayy2k2/tomcat8
service tomcat8 start
wget localhost:8080
backgroun [ -d is not working] - ctrl + a + p + q
browser - http://ip-2:8081/


nginx
172.17.0.3
#sudo docker run --name docker-nginx -p 80:80 -d -v ~/docker-nginx/tml:/usr/share/nginx/html nginx

docker run --name ubuntu-nginx -it -p 80:80 drvijayy2k2/nginx
vi /etc/nginx/conf.d/default.conf
service nginx start
ctrl + a + p + q
browser http://ip-3
docker attach

#add host entry c:\windows\system32\drivers\etc\hosts
ip-3 docker.poc.com
open browser
http://docker.poc.com
#stop the tomcat to see or refersh, it will do the roundrobin by default

SFTP - ip-4
*******
docker run -it -p 8081:22 drvijayy2k2/sftp
service vsftpd start
service ssh start
ctrl + a p q

open winscp
type ur public ip ip-4
port 8081
user john
pwd test123

copy some files to www folder

Tomcat to Support HTTPS / SSL Apache Portable Runtime (APR) with Private key Public Key

1 System Configuration

This document applies to Windows systems running Tomcat 5.5, not to Tomcat 4.1, so it should only be used for sites running MIRC T27 or later. Further, these instructions apply to Tomcat sites running the Apache Portable Runtime (APR). On a Windows computer, this is a dynamically linked library (DLL) that is installed automatically during a Tomcat installation if the user selects the Native option. The APR is strongly recommended, especially on high volume sites, because it is more efficient than the normal Tomcat web server.
You can check whether your system has the APR installed by looking for Tomcat/bin/tcnative-1.dll. If that file is present, Tomcat will automatically use the APR. If your Windows system does not have the APR, you can get it at: http://tomcat.apache.org/tomcat-5.5-doc/apr.html

2 Overview of the Process

When an application (A) establishes an SSL connection to another application (B), it receives encrypted information that identifies B. This information is called a certificate. Certificates are encoded mathematically with keys.
Enabling SSL on a Tomcat installation that is running the APR involves the following steps:

• Create a private key for Tomcat.
• Create a certificate for Tomcat.
• Place the private key and the certificate where Tomcat can find them.
• Configure Tomcat to enable SSL and use the key and certificate.
• Do any MIRC configuration necessary for clinical trials.

The first two steps require the use of an open source SSL tool called OpenSSL.

3 Getting OpenSSL

OpenSSL is developed by the OpenSSL Project. Its web site is: http://www.openssl.org.
A special OpenSSL installer for Windows is available on the Shining Light site at: http://www.slproweb.com/products/Win32OpenSSL.html.
After downloading the installer, run it. The result is a directory called OpenSSL. Inside that directory is a bin directory. Although the installer will create entries in the Programs menu, those entries only point to documentation (and to the uninstaller). The OpenSSL program is a command-line utility. In the instructions that follow, it is assumed that the OpenSSL directory is located in the root of the D drive (D:\OpenSSL).

4 Creating a Private Key for Tomcat

To enable SSL communication, Tomcat must have a certificate. To create a certificate for Tomcat, you must first have a private key. This section will demonstrate how to create a private key using OpenSSL.
To start, create a directory in which to work. In this example, the directory is called sandbox.

• Launch a DOS window. (Click Start -- Run… and type cmd. Then click OK.)
• Navigate to your sandbox directory.
• Enter the command:

d:\openssl\bin\openssl.exe

• OpenSSL will prompt with: OpenSSL>
• Enter the command:

genrsa –des3 –out tomcatkey.pem 2048

• OpenSSL will then ask you for a pass phrase for the key. Enter any phrase you want. In this example, we will use the pass phrase tomcat. After entering the pass phrase, OpenSSL will ask you to repeat it.
• OpenSSL will then create the private key and store it in the sandbox directory in a file called tomcatkey.pem.

You can remain in the OpenSSL program for the next step.

5 Creating a Certificate for Tomcat

Once you have a private key for Tomcat, you must create a certificate. Assuming you are still running the OpenSSL program from the previous step, enter the command:

req –new –x509 –key tomcatkey.pem –out tomcatcert.pem –days 1095

OpenSSL will ask you for the pass phrase that you defined for the private key. This command creates a self-signed certificate with a lifetime of 3 years (1095 days), using the private key. OpenSSL will store that certificate in the sandbox directory in a file called tomcatcert.pem.

6 Storing the Private Key and the Certificate

You must now place the tomcatkey.pem and tomcatcert.pem files where Tomcat can find them. The easiest place to put them is in the top-level Tomcat directory.

7 Enabling SSL in the Tomcat server.xml File

Having put the files in the top-level Tomcat directory, you must now enable SSL in the server.xml file which is located in the conf directory under the top-level Tomcat directory. Using the Tomcat directory in the section above as an example, first make a backup copy of the Tomcat\conf\server.xml file (just in case) and store it somewhere safe. Then open Tomcat\conf\server.xml with a text editor.
Look for the section of code that contains the main connector:

About 10 lines under that look for the code for the SSL connector:

Remove the start and end comment lines, making the code read:

Next, it is necessary to tell Tomcat where the key and certificate are and how to access them. Add the four indented lines near the bottom of the box below, making the code read:

In place of tomcat in the SSLPassword attribute, you must use the pass phrase you chose for the private key. Then, save the file.
This will create an SSL connector on port 8443 when Tomcat is restarted. If you decide to use a different port than 8443, you must change the redirectPort attributes in other Connector elements to point to the port you chose; otherwise, redirections to the SSL port will not occur.
Note: enabling SSL on your site does not disable non-SSL connections, so your site will also continue to work with browsers that are not SSL-enabled.
When modifying XML files, it is usually a good idea to confirm that you have not made a mistake in typing and inadvertently created a file that is not well-formed. An easy way to check is to open the file with Internet Explorer, which will parse the file and either display the text in a nicely formatted window or tell you about the first error it found.
At this point, start (or restart) Tomcat. Launch a browser and go to:

https://localhost:8443/tomcat.gif

If your certificate is self-signed, your browser will warn you. You should tell the browser to import the certificate and proceed. You should then see the little Tomcat logo. If you do, you’re done configuring Tomcat.

Enable SSL Https in Tomcat

1. Generate Keystore

First, uses “keytool” command to create a self-signed certificate. During the keystore creation process, you need to assign a password and fill in the certificate’s detail.

$Tomcat\bin>keytool -genkey -alias mkyong -keyalg RSA -keystore c:\mkyongkeystore
Enter keystore password:
Re-enter new password:
What is your first and last name?
  [Unknown]:  yong mook kim
What is the name of your organizational unit?
  //omitted to save space
  [no]:  yes
 
Enter key password for <mkyong>
        (RETURN if same as keystore password):
Re-enter new password:
 
$Tomcat\bin>

Here, you just created a certificate named “mkyongkeystore“, which locate at “c:\“.

Certificate Details
You can use same “keytool” command to list the existing certificate’s detail

$Tomcat\bin>keytool -list -keystore c:\mkyongkeystore
Enter keystore password:
 
Keystore type: JKS
Keystore provider: SUN
 
Your keystore contains 1 entry
 
mkyong, 14 Disember 2010, PrivateKeyEntry,
Certificate fingerprint (MD5): C8:DD:A1:AF:9F:55:A0:7F:6E:98:10:DE:8C:63:1B:A5
 
$Tomcat\bin>

2. Connector in server.xml

Next, locate your Tomcat’s server configuration file at $Tomcat\conf\server.xml, modify it by adding a connector element to support for SSL or https connection.
File : $Tomcat\conf\server.xml

 //...
 <!-- Define a SSL HTTP/1.1 Connector on port 8443
         This connector uses the JSSE configuration, when using APR, the 
         connector should be using the OpenSSL style configuration
         described in the APR documentation -->
 
 <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" 
        keystoreFile="c:\mkyongkeystore"
        keystorePass="password" />
  //...

Note
keystorePass="password" is the password you assigned to your keystore via “keytool” command.

 

 

3. Done

Saved it and restart Tomcat, access to https://localhost:8443/

In this example, we are using Google Chrome to access the Tomcat configured SSL site, and you may notice a crossed icon appear before the https protocol :), this is caused by the self-signed certificate and Google chrome just do not trust it.
In production environment, you should consider buy a signed certificate from trusted SSL service provider like verisign/digicert or sign it with your own CA server
 

Basic Hacker Skills

When people think of hackers they immediately think of the worst but there are many different types of hackers and most of them has done a great deal to improve and develop software, the Internet and electronic devices.

Hacking skills - You must have the patience and will to understand programming languages. There are dozens of programming languages and they have evolved through the years, so start out with learning the basics. You can begin learning the programming language C then progress to other languages like Pascal or Fortran. Then move on to learning Perl, XHTML and other programs used on the Internet.

Understanding computer hardware is also a must as well as all the components that a computer system needs. You need to understand banking systems, and other systems used in the financial world because this is where you'll learn the kinds of security that are in place to protect the system and its clients.

Security Audit Stages

Stage 1. Automation Auditing
Stage 2. Manual Auditing

Automation Tools:-

1. AppScan
2. Scando
3. Acunetix
etc..

Manual Testing Tools:-

1. Burp Suite
2. IE Tamper
3. Achilles
etc..


How to prevent via coding ?   [Project should implement the following points]:-
Auto Completion for important controls like password
Salted hash for password fields
Sanitization to all the input controls
Browser Refresh [use captcha]
Steal Password via Refresh or back button [use redirection, clear cache]
Session Fixation [ use new session id before/after login ]
Brute Force [use captcha]
Guessing UserID
Always clear Browser cache
Insecure direct object reference  [ in search result screens, avoid give action link with pk id ]
CSRF
Downloading Secure File [ dont take a path from parameter ]
Inproper Error Handling [use proper tr{} catch{}, move to custom error page]
XSS [use sanitization, check server side validation (type,size,input data) ]
SQL Injection [use sanitization]
Cross Account Access
Privileged Escalation
Login Trail
Audit Trail
Forgot Password [use security question, captcha, send a mail link to change password (one time link) ]
etc..

Fraud Detection on Web App

Prerequisites

Before jumping into ways to detect potential fraud in Web applications and services, we need to set a few ground rules. Number one, and most important, you must have adequate logging. For full coverage on appropriate logging, read “How to Do Application Logging Right.”1 At a minimum, consider the five types of logging events covered

• authentication, authorization, and access events;
• changes to the system, application, or data;
• availability issues;
• resource issues;

Impossible Travel
Let’s say you saw the two entries shown in Figure 2 in your logs. These entries show that someone accessed login.jsp twice (let’s assume the same  user and that you have those details in the logs) in two hours. At 10 a.m., an IP address in California accessed  it; at noon, someone in Romania accessed it. The quick math says that no one could travel from California to Romania in two hours, even in an SR-71.
HTTP Request
Looking beyond the User-Agent header, what has changed?
• The order of headers differs.
• The order of cookies differs.
• The headers differ. Only the
first request has Origin and Cache-Control; only the second request has Keep-Alive.
• Regarding Accept-Encoding, only the first request lists each.
•  regarding Accept-Language, the first request has en-US and q=0.8, whereas the second request has en-us and q=0.5.
Fraud Detection in Sessions :- Its like session hacking / session fixation.

Latest News

• Salted Hash Password - OWASP
• Detecting Fraud on Websites
• Secure Issues Handling
• Share with Us
• Exercise

Popular

• Man-In-The-Middle Attack
• OWASP Top 10 Secure for web Application
• What Is a Hacker ?
• Autocomplete
• Salted Hash Password - OWASP

Fraud Detection

Fraud Detection

• Data preprocessing techniques for detection, validation, error correction, and filling up of missing or incorrect data.
• Calculation of various statistical parameters such as averages, quantiles, performance metrics, probability distributions, and so on. For example, the averages may include average length of call, average number of calls per month and average delays in bill payment.
• Models and probability distributions of various business activities either in terms of various parameters or probability distributions.
• Computing user profiles.
• Time-series analysis of time-dependent data.
• Clustering and classification to find patterns and associations among groups of data.
• Matching algorithms to detect anomalies in the behavior of transactions or users as compared to previously known models and profiles. Techniques are also needed to eliminate false alarms, estimate risks, and predict future of current transactions or users.

Let you get more details from :
http://en.wikipedia.org/wiki/Data_Analysis_Techniques_for_Fraud_Detection
http://horicky.blogspot.in/2011/07/fraud-detection-methods.html

For banking
http://www.sqnbankingsystems.com/

For insurance
http://www.capterra.com/insurance-fraud-detection-software

Latest News

• Salted Hash Password - OWASP
• Detecting Fraud on Websites
• Secure Issues Handling
• Share with Us
• Exercise

Popular

• Man-In-The-Middle Attack
• OWASP Top 10 Secure for web Application
• What Is a Hacker ?
• Autocomplete
• Salted Hash Password - OWASP